1658793 - Add Cybertrust Japan SecureSign Roots (CA12, CA14 and CA15)

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task, P2)

Description

[Ben Wilson]

This root inclusion request is in the CCADB as CCADB Case 585.
https://ccadb-public.secure.force.com/mozilla/PrintViewForCase?CaseNumber=00000585

Comment 1

[masahiro.shikutani]

Thanks Ben-san for opening thread.
We are in conducting point-in-time audit for our new roots, but it takes a long time due to COVID-19.
We will have audit report by the end of September.
After we get the report, we will update this thread.

Comment 2

[Ben Wilson]

Just checking in on status of audit reports.
Also, you will need to complete a Baseline Requirements Self-Assessment -
see https://wiki.mozilla.org/CA/BR_Self-Assessment
which links the BR self-assessment spreadsheet template -
https://docs.google.com/spreadsheets/d/1ni41Czial_mggcax8GuCBlInCt1mNOsqbEPzftuAuNQ/edit?usp=sharing

Comment 3

[Ben Wilson]

Do you have any updates on your efforts here?

Comment 4

[Ben Wilson]

On 24-May-2021, I sent an email to applicant's contacts alerting them to the "NEED" info fields in the CCADB. They responded that they would work on them.

Comment 5

[Ben Wilson]

Audits and updated CP and CPS received recently and updated in the CCADB. Applicant still needs to complete a Compliance Self Assessment. https://wiki.mozilla.org/CA/Compliance_Self-Assessment

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:kwilson, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 7

[masahiro.shikutani]

Attachment: CA Compliance Self Assessment_CTJ_20220831.xlsx

Comment 8

[Ben Wilson]

I'll start my review of the Self-Assessment along with CP v. 1.13 and CPS v. 1.02.

Comment 9

[masahiro.shikutani]

Attachment: Key Generation Point-in-Time Audit

Comment 10

[masahiro.shikutani]

Attachment: Key Generation Point-in-Time Audit (WTCA)

Comment 11

[masahiro.shikutani]

Attachment: Key Generation Point-in-Time Audit (WTBR)

Comment 12

[masahiro.shikutani]

Attachment: Key Generation Point-in-Time Audit (WTEV)

Comment 13

[masahiro.shikutani]

Attachment: Key Generation Point-in-Time Audit (WTPCS)

Comment 14

[masahiro.shikutani]

Attachment: Key Generation Point-in-Time Audit (WTEVCS)

Comment 15

[Ben Wilson]

Attachment: CA Compliance Self Assessment_CTJ_20220831-reviewed by Mozilla.xlsx

This review of Cybertrust Japan's compliance self-assessment is based on CP version 1.15 and CPS version 1.04.

Comment 16

[masahiro.shikutani]

Attachment: CA Compliance Self Assessment_CTJ_20220831-reviewed by Mozilla_CTJ_20230414.xlsx

Comment 17

[masahiro.shikutani]

Thank you very much for the DETAILED ROOT PROGRAM REVIEW/ Reviewer Comments (Column C).
Please find our response to your highlighted areas in yellow, which we have documented in Column D as "Response of CTJ to Reviewer Comments (2023/4/14)" in above attached file (https://bugzilla.mozilla.org/attachment.cgi?id=9328540).

We will update our CP/CPS based Column D within approximately one week.
After we update, we will update this bug again.

Comment 18

[Ben Wilson]

Attachment: Value Statement - Cybertrust Japan.pdf

Comment 19

[masahiro.shikutani]

We have updated our CP/CPS based on Column D in above attached file (https://bugzilla.mozilla.org/attachment.cgi?id=9328540) and some additional consideration. Please note that the URL of CP/CPS is the same as before, but the version and content have been updated.
We have also added some information to the file below in relation to Reviewer Comments (Cell C188).
https://www.cybertrust.ne.jp/ssl/repository/Jurisdiction.pdf
We greatly appreciate your review and comments.

Comment 20

[yoshikazu saito]

Attachment: CCADB Self Assessment_(v1.1)_CTJ_20230619.xlsx

Comment 21

[yoshikazu saito]

Attachment: 01_Values & Benefits Statement.pdf

Comment 22

[yoshikazu saito]

Attachment: 02_CA Lifecycle Management.pdf

Comment 23

[yoshikazu saito]

Attachment: 03_Linting.pdf

Comment 24

[yoshikazu saito]

Attachment: 04_Customer and Change Management.pdf

Comment 25

[yoshikazu saito]

Attachment: Point-in-Time Audit(WTEVCS)_20200911-1210.pdf

Comment 26

[yoshikazu saito]

Attachment: Point-in-Time Audit(WTBR)_20200911-1210.pdf

Comment 27

[yoshikazu saito]

Attachment: Point-in-Time Audit(WTEV)_20200911-1210.pdf

Comment 28

[yoshikazu saito]

Attachment: Point-in-Time Audit(WTCA)_20200911-1210.pdf

Comment 29

[yoshikazu saito]

Attachment: Point-in-Time Audit(WTCS)_20200911-1210.pdf

Comment 30

[Dimitris Zacharopoulos]

Hello,

Is it possible to upload searchable versions of those PDF documents?

Thank you.

Comment 31

[iori Kondo]

Attachment: 1.1_CT-RT_Cybertrust_Japan_WTCA_Report for Seal_20210205.pdf

Comment 32

[iori Kondo]

Attachment: 1.2_CT-RT_Cybertrust_Japan_WTBR_Report for Seal_20210205.pdf

Comment 33

[iori Kondo]

Attachment: 1.3_CT-RT_Cybertrust_Japan_WTEV_Report for Seal_20210205.pdf

Comment 34

[iori Kondo]

Attachment: 1.4_CT-RT_Cybertrust_Japan_WTPTCS_Report for Seal_20210205.pdf

Comment 35

[iori Kondo]

Attachment: 1.5_CT-RT_Cybertrust_Japan_WTEVCS_Report for Seal_20210205.pdf

Comment 36

[iori Kondo]

(In reply to Dimitris Zacharopoulos from comment #30)

Hello,

Is it possible to upload searchable versions of those PDF documents?

Thank you.

Hello,

We've uploaded searchable versions of Audit Statements.

Thank you.

Comment 37

[yoshikazu saito]

Attachment: CCADB Self Assessment Framework (v1.2)_CTJ_20231225.xlsx

Comment 38

[iori Kondo]

Attachment: CCADB Self Assessment Framework (v1.2)_CTJ_20240112.xlsx

Comment 39

[yoshikazu saito]

Attachment: 01.CT_RT_CTJ_WTCA_Report-Assertion(CA Key Lifecycle - based on CPA Canada CA7.2)_20240423Signed.pdf

Comment 40

[Ben Wilson]

On May 10, 2024, this request entered the 6-week public discussion period, https://groups.google.com/a/ccadb.org/g/public/c/4OuyyOD-7ng/m/nl-bbjr-AQAJ

Comment 41

[Ben Wilson]

The 6-week public discussion ended (https://groups.google.com/a/ccadb.org/g/public/c/4OuyyOD-7ng/m/1ot5MFk4AAAJ) and today starts a 7-day last-call for comments based on this notice of intent to approve this inclusion request:
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/pJHiCL07E-Q/m/Iw5u64X6AQAJ

Comment 42

[Ben Wilson]

It has been seven days. On behalf of Mozilla, this request from Cybertrust Japan to include the following root certificates is Approved for the websites trust bit with EV enablement:

• SecureSign Root CA12
• SecureSign Root CA14
• SecureSign Root CA15

I will file NSS/PSM bugs for the approved changes.

Comment 43

[Ben Wilson]

These roots are now in NSS 3.104 and Nightly 131.0a1 (2024-08-28). I will open a new bug to add EV.